CVE-2024-21637

Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with `response_mode=form_post`. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.

• CWE-79

• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.6Patch
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.6Patch
• https://github.com/goauthentik/authentik/security/advisories/GHSA-rjpr-7w8c-gv3jMitigation, Third Party Advisory
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.10.6Patch
• https://github.com/goauthentik/authentik/releases/tag/version%2F2023.8.6Patch
• https://github.com/goauthentik/authentik/security/advisories/GHSA-rjpr-7w8c-gv3jMitigation, Third Party Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21631Vapor is an HTTP web framework for Swift. Prior to version 4…6.5
• CVE-2024-21632omniauth-microsoft_graph provides an Omniauth strategy for t…9.8
• CVE-2024-21633Apktool is a tool for reverse engineering Android APK files.…7.8
• CVE-2024-21634Amazon Ion is a Java implementation of the Ion data notation…7.5
• CVE-2024-21635Memos is a privacy-first, lightweight note-taking service th…7.5
• CVE-2024-21636view_component is a framework for building reusable, testabl…6.1
• CVE-2024-21638Azure IPAM (IP Address Management) is a lightweight solution…9.8
• CVE-2024-21639CEF (Chromium Embedded Framework ) is a simple framework for…9.6
• CVE-2024-21640Chromium Embedded Framework (CEF) is a simple framework for …9.6
• CVE-2024-21641Flarum is open source discussion platform software. Prior to…4.7
• CVE-2024-21642D-Tale is a visualizer for Pandas data structures. Users hos…7.5
• CVE-2024-21643IdentityModel Extensions for .NET provide assemblies for web…8.8